I85PREP
⌘ K
CCISO study materials
CCISO study resources

CCISO practice questions

One question at a time. Build your CCISO understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance, Risk, and Compliance

An organization's information security strategy is being drafted. Which document establishes the executive-level direction and intent for security across the whole enterprise?

  1. The information security policy Correct answer.
  2. The firewall configuration standard
  3. The incident response runbook
  4. The vulnerability scan report

Explanation

An information security policy is the top-level governance instrument that expresses management's direction, objectives, and mandatory requirements for protecting information assets. Standards, procedures, and operational records sit beneath it and must remain consistent with it.

Question 2Governance, Risk, and Compliance

A CISO wants to know whether security controls are designed appropriately, independent of whether they operate effectively day to day. Which activity answers that question?

  1. A control design assessment Correct answer.
  2. A log review
  3. A penetration test
  4. A business impact analysis

Explanation

A design assessment evaluates whether a control, as documented and implemented, is capable of meeting its objective. Effectiveness testing and operational monitoring are separate activities that examine whether the control actually works in practice.

Question 3Governance, Risk, and Compliance

Which risk treatment option involves transferring the financial consequence of a risk to another party while the organization retains the underlying activity?

  1. Risk transfer Correct answer.
  2. Risk mitigation
  3. Risk acceptance
  4. Risk avoidance

Explanation

Risk transfer shifts the financial impact, typically through insurance or contractual indemnity, without eliminating the activity that creates the exposure. Avoidance removes the activity, acceptance retains the exposure, and mitigation reduces likelihood or impact.

Question 4Governance, Risk, and Compliance

Which metric best expresses the organization's overall exposure to loss from a given risk scenario in monetary terms?

  1. Patch compliance rate
  2. Mean time to detect
  3. Annualized loss expectancy Correct answer.
  4. Control maturity score

Explanation

Annualized loss expectancy combines the single-loss magnitude with the estimated annual frequency of the event, producing an expected yearly monetary exposure. It is a core input to quantitative risk prioritization and cost-benefit analysis of controls.

Question 5Governance, Risk, and Compliance

Under a typical data protection regulation, which party determines the purposes and means of processing personal data?

  1. The data subject
  2. The supervisory authority
  3. The data processor
  4. The data controller Correct answer.

Explanation

The controller is the entity that decides why and how personal data is processed and therefore bears primary accountability for compliance. Processors act on the controller's documented instructions, subjects are the individuals, and authorities are the regulators.

Question 6Governance, Risk, and Compliance

Which element is essential for a security policy to be enforceable within an organization?

  1. An annual penetration test
  2. Vendor product endorsements
  3. Executive sponsorship and approval Correct answer.
  4. A published technical appendix

Explanation

Policy authority derives from approval at an appropriate executive level, which gives it legitimacy and backing across business units. Without that sponsorship, enforcement mechanisms such as sanctions and exceptions have no organizational weight.

Question 7Governance, Risk, and Compliance

What is the primary purpose of a risk register in a governance program?

  1. To store system configuration baselines
  2. To document employee training completion
  3. To record identified risks, owners, ratings, and treatment status Correct answer.
  4. To catalogue software licenses

Explanation

A risk register is the system of record for risk identification, assessment, ownership, and treatment tracking, enabling consistent reporting to leadership. It supports prioritization and demonstrates that risks are being actively managed.

Question 8Governance, Risk, and Compliance

Which role is typically accountable for accepting residual risk that exceeds the organization's stated risk appetite?

  1. The security analyst on duty
  2. The external auditor
  3. The help desk supervisor
  4. The business or executive risk owner Correct answer.

Explanation

Risk acceptance is a business decision that must be made by the accountable executive who owns the affected process and has authority over the associated loss. Security staff advise on the risk but do not own the business consequence.

Question 9Governance, Risk, and Compliance

A regulator requires the organization to demonstrate that security controls are operating effectively over time. Which activity most directly produces that evidence?

  1. Scheduled control effectiveness testing with retained results Correct answer.
  2. Publishing the security policy on the intranet
  3. Reviewing the asset inventory
  4. Conducting a tabletop exercise once

Explanation

Ongoing effectiveness testing generates contemporaneous evidence that controls function as intended, and retaining the results allows the organization to demonstrate compliance over the review period. Policy publication and one-off events do not show sustained operation.

Question 10Governance, Risk, and Compliance

A business unit wants to adopt a cloud service that stores regulated data. The security team cannot complete its review before the contract signing deadline. What is the most appropriate governance action?

  1. Delegate the approval to the cloud vendor's security team
  2. Approve the service informally and complete the review later
  3. Escalate the residual risk to the accountable executive for a documented acceptance decision Correct answer.
  4. Block the service permanently without further discussion

Explanation

When a review cannot be completed, the decision to proceed becomes a residual risk acceptance that must be made by the accountable executive and documented. This preserves accountability and creates an auditable record rather than bypassing governance.

Question 11Governance, Risk, and Compliance

An organization defines risk appetite as low. A proposed project would introduce a high residual risk even after controls. What should governance dictate?

  1. The risk rating is lowered to match appetite
  2. The project must be redesigned, rejected, or escalated for explicit exception approval Correct answer.
  3. The project proceeds if the vendor signs a contract
  4. The project proceeds because controls were considered

Explanation

Risk appetite sets the boundary within which the organization is willing to operate, so a proposal exceeding it cannot be approved through normal channels. It must be redesigned to reduce exposure or escalated for a formal, documented exception by the appropriate authority.

Question 12Governance, Risk, and Compliance

A CISO is mapping security activities to a recognized control framework to support an audit. What is the main benefit of this mapping?

  1. It provides a common structure for scoping, assessing, and reporting control coverage Correct answer.
  2. It guarantees the organization will pass the audit
  3. It eliminates the need for internal testing
  4. It replaces the need for a risk assessment

Explanation

A recognized framework supplies a shared vocabulary and structure that lets auditors and management evaluate coverage consistently and identify gaps. It supports assurance but does not by itself guarantee outcomes or remove the need for testing and risk analysis.

Question 13Governance, Risk, and Compliance

During a third-party risk review, a critical supplier reports a breach affecting the organization's data. Which governance obligation takes priority first?

  1. Wait for the supplier to complete its own remediation
  2. Renegotiate the contract pricing terms
  3. Update the marketing website
  4. Trigger the contractual notification and incident governance process with defined roles Correct answer.

Explanation

Contractual and regulatory notification obligations are time-bound, so the incident governance process with preassigned roles must be activated immediately. Remediation and commercial discussions follow once containment and notification duties are addressed.

Question 14Governance, Risk, and Compliance

What distinguishes a standard from a procedure in a security governance hierarchy?

  1. A standard applies to vendors, while a procedure applies to employees
  2. A standard is optional, while a procedure is mandatory
  3. A standard is technical, while a procedure is managerial
  4. A standard states mandatory requirements, while a procedure gives step-by-step instructions Correct answer.

Explanation

Standards translate policy into specific mandatory requirements such as configuration baselines, while procedures describe the sequence of steps used to carry them out. Both are mandatory, and their distinction lies in level of detail rather than audience.

Question 15Governance, Risk, and Compliance

An organization wants to determine whether a new regulation applies to its processing activities. Which action is the most defensible first step?

  1. Ask the IT department whether it feels the regulation applies
  2. Delay analysis until an enforcement action occurs
  3. Perform a data inventory and map processing activities to the regulation's scope criteria Correct answer.
  4. Adopt the strictest interpretation of every regulation globally

Explanation

Applicability depends on factual scope criteria such as data types, locations, and processing roles, which require a documented data inventory to evaluate. A structured mapping produces defensible conclusions and supports proportionate compliance effort.

Question 16Governance, Risk, and Compliance

A risk assessment identifies a vulnerability with high likelihood but very low impact. How should a risk-based governance program typically treat it?

  1. Treat it identically to catastrophic risks
  2. Escalate it immediately to the board
  3. Remove it from the register to reduce noise
  4. Prioritize it below high-impact risks and address it through routine operational processes Correct answer.

Explanation

Risk prioritization weighs likelihood against impact, so low-impact items generally belong in routine remediation rather than executive escalation. Keeping them in the register preserves visibility while directing scarce attention to higher-exposure risks.

Question 17Governance, Risk, and Compliance

Which statement best describes the relationship between governance and management in a security program?

  1. Governance and management are identical functions
  2. Governance sets direction and oversight, while management executes and operates controls Correct answer.
  3. Governance operates controls, while management sets direction
  4. Governance is performed only by external auditors

Explanation

Governance establishes objectives, decision rights, and oversight through the board and executive leadership, while management implements and runs the program day to day. Separating the two preserves accountability and independent oversight.

Question 18Governance, Risk, and Compliance

An organization adopts a control framework but finds many controls do not map to its actual business processes. What is the most appropriate response?

  1. Report full compliance based on the framework adoption
  2. Perform a gap analysis and tailor the framework to the organization's risk profile Correct answer.
  3. Implement every framework control regardless of relevance
  4. Discard the framework and build controls from scratch

Explanation

Frameworks are reference models, not one-size-fits-all mandates, so a gap analysis identifies where organizational context requires tailoring or additional controls. Tailoring keeps the program risk-based and defensible while retaining framework structure for reporting.

Question 19Governance, Risk, and Compliance

A board asks for a single view of the organization's top security risks and their treatment status. Which reporting approach best serves this need?

  1. A full dump of every vulnerability finding
  2. A list of all security policies in force
  3. A summary of help desk ticket volumes
  4. A risk dashboard summarizing top risks, ratings, owners, and treatment progress Correct answer.

Explanation

Executive reporting should aggregate the most significant risks with owner accountability and treatment status so the board can exercise oversight efficiently. Detailed operational data obscures the decision-relevant picture at board level.

Question 20Governance, Risk, and Compliance

An organization must retain evidence of compliance activities for a defined period. Which practice best supports defensible retention?

  1. Storage of evidence only in individual employee mailboxes
  2. Deletion of records once a control is tested
  3. Indefinite storage of all records without classification
  4. A documented retention schedule aligned to legal and contractual requirements Correct answer.

Explanation

A retention schedule tied to legal, regulatory, and contractual obligations ensures evidence is kept long enough and disposed of appropriately. It also supports consistency and defensibility during audits or investigations.

Question 21Governance, Risk, and Compliance

A security exception to policy is requested for a legacy system that cannot meet the current standard. What governance conditions make the exception defensible?

  1. Automatic renewal without reassessment
  2. Permanent approval with no review
  3. Verbal approval from the system administrator
  4. Documented compensating controls, a defined expiry, and approval by the accountable owner Correct answer.

Explanation

A defensible exception records why the standard cannot be met, what compensating controls reduce the exposure, when it expires, and who accepted the residual risk. Time-limiting the exception forces reassessment and prevents permanent drift from policy.

Question 22Governance, Risk, and Compliance

An organization operates in multiple jurisdictions with conflicting data localization requirements. What governance approach is most sound?

  1. Apply the least strict jurisdiction's rules everywhere
  2. Map obligations per jurisdiction and design controls that satisfy the strictest applicable requirement where feasible Correct answer.
  3. Ignore localization rules and rely on standard contracts
  4. Store all data in a single location regardless of obligations

Explanation

Conflicting obligations require a jurisdiction-by-jurisdiction mapping so the organization can identify where a single control set satisfies multiple regimes or where localized handling is needed. Designing to the strictest feasible requirement reduces the risk of breaching any single regime.

Question 23Governance, Risk, and Compliance

A risk assessment produces qualitative ratings that executives distrust because different assessors rate similar risks very differently. What change most improves consistency?

  1. Reduce the number of risks assessed
  2. Define calibrated rating criteria with anchored definitions and reviewer validation Correct answer.
  3. Raise all ratings to the highest tier
  4. Replace the assessment with a checklist

Explanation

Inconsistent ratings usually stem from undefined scales, so anchored criteria that describe what each level means reduce subjective variation. Calibration sessions and reviewer validation further align assessors and improve confidence in the results.

Question 24Governance, Risk, and Compliance

A CISO must justify security investment to the finance committee. Which argument is most aligned with governance expectations?

  1. The number of security tools already deployed
  2. A claim that breaches are inevitable
  3. Comparison with a competitor's security budget
  4. Quantified risk reduction compared with the cost of the proposed control Correct answer.

Explanation

Governance decisions weigh expected risk reduction against cost, so framing investment as avoided loss or reduced exposure supports a defensible business case. Tool counts and competitor comparisons do not demonstrate value to the organization's own risk profile.

Question 25Governance, Risk, and Compliance

An internal audit finds that a key control has been operating without documented ownership for two years. What is the most significant governance implication?

  1. Accountability for the control's effectiveness is unclear, undermining assurance Correct answer.
  2. The control is automatically ineffective
  3. The control should be removed from the framework
  4. The audit finding can be closed without action

Explanation

Control ownership assigns responsibility for operation, monitoring, and remediation, so its absence means no one is accountable for effectiveness. That gap weakens assurance even if the control currently appears to function.

Question 26Governance, Risk, and Compliance

Which document type typically states a mandatory course of action that employees must follow, and whose violation may trigger disciplinary measures?

  1. A security vision statement
  2. A security guideline
  3. A security policy Correct answer.
  4. A security awareness brochure

Explanation

A policy is a mandatory directive that articulates management's intent and required behavior, and it carries consequences for noncompliance. Guidelines are recommended, non-binding advice, while vision statements and awareness materials communicate intent without imposing enforceable obligations.

Question 27Governance, Risk, and Compliance

In a security governance structure, what is the primary function of a steering committee?

  1. To perform daily monitoring of security alerts
  2. To draft firewall rule changes for the network team
  3. To prioritize security initiatives and align them with business objectives Correct answer.
  4. To conduct technical penetration tests on production systems

Explanation

A steering committee is a governance body that sets direction, resolves competing priorities, and ensures security investments support business goals. Operational tasks such as alert monitoring, penetration testing, and firewall changes belong to execution teams rather than a governance committee.

Question 28Governance, Risk, and Compliance

An organization is aligning its security program with a widely used industry framework to demonstrate due diligence to customers. Which benefit most directly justifies adopting such a framework?

  1. It replaces the need for any internal risk assessment
  2. It eliminates the need for management oversight of security
  3. It provides a common, recognized structure for selecting and communicating controls Correct answer.
  4. It guarantees the organization will never experience a breach

Explanation

Frameworks offer a shared vocabulary and structured catalog of controls that supports consistent selection, comparison, and communication with stakeholders. They do not guarantee breach prevention, substitute for risk assessment, or remove management responsibility.

Question 29Governance, Risk, and Compliance

Which term describes the level of risk an organization is willing to accept in pursuit of its objectives before action is required?

  1. Risk appetite Correct answer.
  2. Risk transfer
  3. Risk tolerance
  4. Risk register

Explanation

Risk appetite is the amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. Risk tolerance refers to the acceptable variation around that appetite, while a risk register is a log of risks and risk transfer is a treatment option.

Question 30Governance, Risk, and Compliance

A compliance manager is building a control inventory and wants each control traceable to the requirement it satisfies. Which practice best achieves this traceability?

  1. Documenting controls only after an audit finding occurs
  2. Relying on vendor attestations instead of internal documentation
  3. Mapping each control to the specific regulatory or framework requirement it addresses Correct answer.
  4. Storing control descriptions in separate spreadsheets per team

Explanation

A control-to-requirement mapping creates a defensible chain showing why each control exists and which obligation it satisfies. Fragmented spreadsheets, reactive documentation, and reliance on vendor attestations all break traceability and weaken audit readiness.

Question 31Governance, Risk, and Compliance

An organization discovers that a legacy application cannot meet a new encryption standard within the required deadline. What is the most appropriate governance response?

  1. Grant a documented, time-bound exception with compensating controls and owner approval Correct answer.
  2. Ignore the gap until the next external audit
  3. Silently waive the requirement without documentation
  4. Disable the encryption standard for the entire organization

Explanation

A formal exception records the risk, assigns an accountable owner, defines compensating controls, and sets an expiry so the deviation is visible and managed. Undocumented waivers, organization-wide rollbacks, and deferred action remove oversight and increase exposure.

Question 32Governance, Risk, and Compliance

A risk analyst rates a threat as high likelihood but negligible impact, producing a moderate overall score. How should a risk-based governance process treat this item?

  1. Close it without recording the decision
  2. Immediately fund a major remediation program
  3. Accept and monitor it, documenting the rationale Correct answer.
  4. Escalate it to the board as a top enterprise risk

Explanation

Low-impact risks are generally accepted and monitored rather than escalated or heavily funded, but the acceptance decision and rationale must be documented for accountability. Board escalation and major funding are disproportionate, and silent closure breaks the audit trail.

Question 33Governance, Risk, and Compliance

A CISO wants to show the audit committee that security controls are operating as designed over the past year. Which evidence source most directly supports this assertion?

  1. The organization's security awareness training catalog
  2. Results of control testing and monitoring records collected throughout the period Correct answer.
  3. The approved security policy document
  4. A vendor's marketing brochure describing its product

Explanation

Operating effectiveness is demonstrated by evidence of controls actually functioning over time, such as test results, logs, and monitoring records. A policy shows intent, a training catalog shows available content, and marketing material proves nothing about the organization's controls.

Question 34Governance, Risk, and Compliance

A multinational firm faces conflicting data residency laws across the jurisdictions where it operates. Which governance approach is most appropriate?

  1. Apply the least strict law uniformly to simplify operations
  2. Relocate all data to a single country regardless of legal constraints
  3. Map obligations per jurisdiction and design controls that satisfy the strictest applicable requirement Correct answer.
  4. Delegate the decision entirely to individual business units

Explanation

A jurisdiction-by-jurisdiction obligation map lets the organization design controls that meet the strictest applicable requirement while documenting localized differences. Uniformly applying the weakest law, ignoring legal constraints, or decentralizing the decision exposes the firm to regulatory penalties.

Question 35Governance, Risk, and Compliance

A governance team finds that different assessors assign widely different ratings to similar risks, undermining executive confidence. Which action best improves consistency?

  1. Adopt a defined risk scoring methodology with calibrated criteria and assessor training Correct answer.
  2. Have executives personally rate every individual risk
  3. Remove impact criteria from the assessment to reduce variability
  4. Replace all qualitative ratings with a single numeric score

Explanation

A documented methodology with calibrated likelihood and impact criteria, reinforced by assessor training, reduces subjective variation and builds trust in the ratings. Collapsing to one number, dropping impact criteria, or having executives rate every risk does not fix the underlying inconsistency.

Question 36Governance, Risk, and Compliance

Which activity best demonstrates that a security program is subject to independent governance oversight rather than self-assessment alone?

  1. The CISO signs a statement affirming the program is effective
  2. The security team reviews its own procedures annually
  3. The vendor provides a self-attestation questionnaire
  4. Internal audit or an independent function reviews security controls and reports to the board Correct answer.

Explanation

Independent review by internal audit or another function outside the security team, with reporting to the board, provides objective assurance. Self-review, self-attestation by the CISO, and vendor questionnaires lack the independence needed for credible oversight.

Question 37Governance, Risk, and Compliance

A regulator asks the organization to prove that a specific control has been consistently applied to all in-scope systems over the last two years. Which practice most strongly supports this proof?

  1. An oral confirmation from the system owner
  2. A one-time screenshot taken during the most recent audit
  3. A summary memo written after the regulator's request
  4. Continuous, timestamped evidence collection retained for the required period Correct answer.

Explanation

Continuous, timestamped evidence retained for the mandated period demonstrates consistent application across time and scope. A single screenshot, verbal confirmation, or after-the-fact memo cannot show sustained operation and is easily challenged.

Question 38Governance, Risk, and Compliance

A board member argues that security spending should be justified purely by avoiding fines. Which framing best reflects mature governance expectations for security investment?

  1. Security is a cost center with no measurable business value
  2. Security spending should always equal a fixed percentage of revenue
  3. Security investment protects business objectives, enables trusted operations, and manages risk within appetite Correct answer.
  4. Security investment should be deferred until a breach occurs

Explanation

Mature governance frames security as enabling business objectives and managing risk within appetite, not merely avoiding penalties. Treating security as valueless, applying a rigid revenue percentage, or waiting for a breach ignores both risk and business enablement.

Question 39Governance, Risk, and Compliance

An audit reveals that a critical control has operated for two years without a documented owner. Which remediation most directly restores governance accountability?

  1. Add more automated alerts to the control
  2. Archive the audit finding after acknowledging it
  3. Increase the frequency of the control's execution
  4. Assign an accountable owner, define responsibilities, and confirm ownership in the control inventory Correct answer.

Explanation

Accountability requires a named owner with defined responsibilities recorded in the control inventory so the control is managed, not orphaned. More alerts or higher execution frequency do not assign responsibility, and archiving the finding without action leaves the gap unresolved.

Question 40Governance, Risk, and Compliance

An organization wants to integrate security risk into enterprise risk management so that security risks are comparable with financial and operational risks. Which design choice best achieves this integration?

  1. Maintaining a separate security risk register that is never shared with enterprise risk staff
  2. Restricting security risk reporting to the IT department
  3. Using a common risk taxonomy, scoring scale, and reporting cadence shared with enterprise risk management Correct answer.
  4. Reporting only technical vulnerability counts to the board

Explanation

Integration requires a shared taxonomy, scoring scale, and reporting rhythm so security risks can be compared and aggregated alongside other enterprise risks. An isolated register, vulnerability counts alone, or IT-only reporting prevents comparability and enterprise visibility.

Question 41Information Security Controls, Audit, and Compliance

A CISO is asked to explain why an information security program needs controls beyond purely technical safeguards. Which category of controls primarily addresses employee behavior and management oversight?

  1. Compensating controls
  2. Administrative controls Correct answer.
  3. Technical controls
  4. Physical controls

Explanation

Administrative controls are management-oriented safeguards such as policies, procedures, training, and segregation of duties that shape how people act. Technical controls are implemented through technology, and physical controls protect facilities and hardware. Compensating controls are alternatives implemented when a primary control cannot be applied, not a behavioral category.

Question 42Information Security Controls, Audit, and Compliance

During an audit of a payment processing environment, the auditor finds that a developer has production database write access. Which control principle is most directly violated?

  1. Defense in depth
  2. Mandatory vacation
  3. Segregation of duties
  4. Least privilege Correct answer.

Explanation

Least privilege requires that users receive only the access necessary for their job functions; a developer who does not need production write access should not have it. Segregation of duties concerns separating incompatible responsibilities between people, which is related but not the same principle. Defense in depth and mandatory vacation address layered protection and fraud detection, respectively.

Question 43Information Security Controls, Audit, and Compliance

Which audit evidence type provides the strongest direct assurance that a firewall rule is currently enforced?

  1. A verbal confirmation from the network team lead
  2. A screenshot of the firewall configuration taken by the administrator
  3. A configuration export generated by the firewall and reviewed by the auditor Correct answer.
  4. A copy of the change management policy

Explanation

A configuration export generated directly by the device and independently reviewed by the auditor is system-generated evidence that reflects the actual running configuration. Screenshots supplied by the administrator can be altered or outdated, and verbal confirmation is not documentary evidence. A policy document describes intended practice, not the current technical state.

Question 44Information Security Controls, Audit, and Compliance

An organization must retain security logs for one year to satisfy a regulatory requirement. Which control type best describes the automated log archival process?

  1. Detective Correct answer.
  2. Corrective
  3. Preventive
  4. Directive

Explanation

Log archival supports later review and investigation, so it functions as a detective control that enables detection of events after the fact. Preventive controls stop an event before it occurs, corrective controls restore systems after an incident, and directive controls establish required behavior through policy or instruction.

Question 45Information Security Controls, Audit, and Compliance

A security manager is designing controls for a new cloud SaaS deployment. Which approach best reflects a risk-based control selection process?

  1. Select controls based only on the lowest implementation cost
  2. Prioritize controls that mitigate the highest-rated risks to the organization's data and services Correct answer.
  3. Adopt the controls used by the largest competitor in the same industry
  4. Implement every control listed in a widely used security framework

Explanation

Risk-based control selection starts from an assessment of likelihood and impact and then chooses controls that reduce the most significant risks to acceptable levels. Frameworks provide catalogs of controls but do not determine which are most important for a given organization. Competitor practices and cost alone are not reliable substitutes for risk analysis.

Question 46Information Security Controls, Audit, and Compliance

Which document establishes the authority and independence of an organization's internal audit function?

  1. The audit report
  2. The audit charter Correct answer.
  3. The audit program
  4. The audit plan

Explanation

The audit charter formally defines the internal audit function's purpose, authority, and reporting lines, including its independence from management. The audit plan schedules engagements, the audit report communicates findings, and the audit program lists the specific procedures for one engagement.

Question 47Information Security Controls, Audit, and Compliance

An auditor identifies a deficiency in the design of a control and separately notes that the control was not operating as designed. How should these findings be classified?

  1. The first is an operating deficiency and the second is a design deficiency
  2. The first is a design deficiency and the second is an operating effectiveness deficiency Correct answer.
  3. Both are operating deficiencies
  4. Both are design deficiencies

Explanation

A design deficiency exists when a control, as designed, cannot meet its objective or is missing. An operating effectiveness deficiency exists when a properly designed control is not applied consistently or does not function as intended. The two findings therefore belong to different categories.

Question 48Information Security Controls, Audit, and Compliance

Which factor most threatens the independence of an internal auditor reviewing the organization's identity management program?

  1. The auditor has ten years of identity management experience
  2. The auditor previously managed the identity management team being audited Correct answer.
  3. The auditor uses the organization's standard audit workpapers
  4. The auditor reports findings to the audit committee

Explanation

Independence is impaired when an auditor has recently been responsible for the area under review, because self-review creates a conflict of interest. Relevant experience, standard workpapers, and reporting to the audit committee all support audit quality rather than threaten independence.

Question 49Information Security Controls, Audit, and Compliance

An organization is subject to a regulation requiring annual independent penetration testing. Which activity best demonstrates compliance with this requirement?

  1. A vulnerability scan performed quarterly by the internal IT team
  2. A tabletop exercise simulating a ransomware incident
  3. An annual penetration test performed by a qualified external firm with a report retained Correct answer.
  4. A code review conducted by the development team before each release

Explanation

The requirement specifies an annual independent penetration test, so the evidence must show a qualified external party performing that test and the resulting report being retained. Vulnerability scanning and internal code review are useful but do not meet the independence or depth requirements. A tabletop exercise tests response processes, not penetration resistance.

Question 50Information Security Controls, Audit, and Compliance

Which metric best indicates that a vulnerability management control is operating effectively over time?

  1. The percentage of critical vulnerabilities remediated within the defined service level Correct answer.
  2. The total number of scans performed since the program began
  3. The number of staff trained on the vulnerability management tool
  4. The number of vulnerabilities detected in the latest scan

Explanation

The percentage of critical vulnerabilities remediated within the agreed service level measures whether the control actually reduces risk in a timely manner. Raw counts of findings or scans do not show whether remediation occurs. Training counts measure awareness activity, not remediation performance.